1

Im trying to reverse engineer a protocol in which some text is sent and has a specific number appended. I figured out that the number is some kind of a checksum (depends on the text somehow) and also that it increments by one on cases such as this: "aaaaaaab" = X and "aaaaaaba" = X+1. Does anyone here have any idea what I could be dealing with?

Additional data:

iiiiiiii =  4d0b 
iiiiiiil =  920b 
iiiiiill =  ce0b 
iiiiilll =  120c 
iiiillll =  5a0c 
iiilllll =  990c 
iillllll =  dd0c 
illlllll =  210d 
llllllll =  680d
liiiiiii =  940b 
iliiiiii =  950b 
iiliiiii =  960b 
iiiliiii =  970b 
iiiiliii =  980b 
iiiiilii =  990b 
iiiiiili =  9b0b 
iiiiiiil =  920b 
aaaaaaaa =  210f 
aaaaaaab =  a110 
aaaaaaba =  a210 
aaaaaaca =  9f0f 
aaaaaacb =  1f11 
baaaaaaa =  a610

The second part is what I have deduced to be the number which depends on the string. It's also obvious from the data that the first two digits are least significant.

ProtoRev
  • 11
  • 2
  • 2
    Could literally be anything. Can you look at the binary producing the data? – Jonathon Reinhart Mar 30 '17 at 02:54
  • I can but I'm not technically able to follow the flow of execution. There are some other information that I have gathered by sniffing the connection the software creates. I'm adding it on the main question. Thank you! – ProtoRev Mar 30 '17 at 05:37
  • 1
    Can you share the binary which computes the data ? – w s Mar 30 '17 at 06:12
  • It actually communicates with a device so it's probably going to be a bit difficult to simulate the environment. Either way the software can be found at http://en.realandbio.com/download/software-download_c0003 . It is the RIMS binary. – ProtoRev Mar 30 '17 at 07:00
  • May be that's not that helpful, but here is the list what is NOT this checksum. It's not BSD checksum, CRC-16-CCITT, CRC-16-IBM, CRC-16-T10-DIF, CRC-16-DNP and CRC-16-DECT – w s Mar 30 '17 at 07:14
  • At this point anything is helpful. Thank you! – ProtoRev Mar 30 '17 at 07:49
  • 1
    I think you should make an effort reverse engineering the code producing said checksum, and ask specific questions relating to understanding the code. – NirIzr Mar 30 '17 at 12:56

0 Answers0